[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)
; |9 M7 k& n3 X+ b
Keyboard Interrupt Hook using I/O APIC

- |8 v. @8 g# N* n6 D  mBy: chpie
Keyboard Interrupt Hooking by manipulating the I/O APIC
/ I' I9 t! ]+ {1 E; E9 x7 vtested on the winXP, Pentium D Hyper-threading Enabled.
+ n/ Q: ^5 L% U0 _( G
' t% G, |6 v! t0 v# s0 _- J
Summary :: Using the 8259a compatible PIC to be deliver the interrupt
& j/ }4 N3 s/ _# g; p4 ?signal by Delivery mode of the I/O APIC to be the ExtINT,
the interrupt related by the IRQ 1 able to be not refer
5 Y0 x8 H4 T( Kthe I/O APIC's Redirection Table.
% G9 N' ?4 I& l$ m: U+ r
! [) [3 t. Z  b$ F1 |+ r! ^: D2 r8 l- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
& D. |& r) e3 Y# x! m2 w) d- The vector can be hidden on the thread getting the keyboard
& f& {0 [+ X2 @. v8 V1 E9 I( \vector from the I/O APIC.
! q$ g, I: N# A2 k2 Y
Flow ::

- ?. w3 m- o" i% J  V2 {+ K1. IRQ 1 Assert !!!
' U0 [; G9 r2 L) e% C; i7 i2. The I/O APIC receives the signal and refers the I/O Redirection table.
3. Sending the signal from the destination Local APIC.
4. Local APIC pass the signal to the processor for its delivery mode ExtINT
3 \2 F' r9 u" P# x5. A processor receives the signal.
' I! g5 F% [+ e0 x2 J. T6. The processor Assert the INTA signal.
7. The I/O APIC acknowledged.
8. The processor Assert the second INTA signal.
9. The I/O APIC delivers the signal to the 8259a compatible PIC
for ExtINT to its Delivery mode.
10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
( q8 e. E# i  B8 U4 _6 l11. The processor execute 2 bytes sended.
$ E" A7 V$ d% O1 X4 O- x* M# P12. our interrupt handler executed.

9 w( H2 x: e% A9 e: N' E2 w
sourcecode and binary are available on the
" a9 G# f, y  x& g# V" Q  chttp://www.rootkit.com/vault/chpie/apic_keyboard.zip